用户权限的修正

wwwroot/mes/tree.ashx

@@ -25,50 +25,59 @@ public class tree : IHttpHandler, IReadOnlySessionState
         {
             //按功能权限过滤显示树菜单（有子节点权限，不具备父节点权限，也要加进来）
             DataTable dt = conn.ExecuteDatatable(@"
-                SELECT 
-                    0 AS id,
-                    f.FUNCTIONLEVEL AS code,
-                    f.FUNCTIONNAME AS text,
-                    f.URL AS url
-                FROM 
-                    TP_SYS_FUNCTION f
-                WHERE 
-                    f.IS_WEB = '1'
-                    AND 
-                        ((f.FUNCTIONCODE IN (SELECT FUNCTIONCODE FROM TP_MST_USERRIGHT  WHERE USERID = @USERID@)) 
-                        OR (f.FUNCTIONCODE IN (SELECT SUBSTR( FUNCTIONCODE, 1, LENGTH( FUNCTIONCODE ) - 2 ) FROM TP_MST_USERRIGHT WHERE USERID = @USERID@ )))
-                ORDER BY 
-                    f.FUNCTIONLEVEL,
-                    f.FUNCTIONCODE
+                   SELECT 0               AS id
+                          ,f.functionlevel AS code
+                          ,f.functionname  AS text
+                          ,f.url           AS url
+                          ,f.functioncode  AS functioncode
+                      FROM tp_sys_function f
+                     WHERE f.is_web = '1'
+                       AND f.valueflag = '1'
+                       AND EXISTS
+                     (SELECT 1
+                              FROM (SELECT uf.functionlevel
+                                          ,uf.functioncode
+                                      FROM tp_mst_userright ur
+                                     INNER JOIN tp_sys_function uf
+                                        ON uf.functioncode = ur.functioncode
+                                     WHERE uf.is_web = '1'
+                                       AND uf.valueflag = '1'
+                                       AND ur.userid = @USERID@) uu
+                             WHERE ((uu.functionlevel = f.functionlevel AND uu.functioncode = f.functioncode) OR
+                                   (uu.functionlevel <> f.functionlevel AND
+                                   uu.functionlevel LIKE f.functionlevel || '%'))
+                                   )
+                     ORDER BY f.functionlevel
+                             ,f.functioncode
                 ",
                 new CDAParameter("USERID",context.Session["userId"])
             );
 
             //添加动态报表菜单=================================
             //使用try容错，避免没有动态报表的出错
-            try
-            {
-                DataTable dtReport = conn.ExecuteDatatable(@"
-                    SELECT 
-                        REPORTID AS id,
-                        REPORTCODE AS code,
-                        REPORTNAME AS text,
-                        '/mes/dr/drmain/drmain_index.html?id='||REPORTID AS url
-                    FROM 
-                        T_MST_DR_REPORT
-                    WHERE 
-                        VALUEFLAG = '1'
-                    ORDER BY 
-                        REPORTCODE
-                    ",
-                    new CDAParameter("USERID",context.Session["userId"])
-                );
-                dt.Merge(dtReport);
-            }
-            catch
-            {
+            //try
+            //{
+            //    DataTable dtReport = conn.ExecuteDatatable(@"
+            //        SELECT 
+            //            REPORTID AS id,
+            //            REPORTCODE AS code,
+            //            REPORTNAME AS text,
+            //            '/mes/dr/drmain/drmain_index.html?id='||REPORTID AS url
+            //        FROM 
+            //            T_MST_DR_REPORT
+            //        WHERE 
+            //            VALUEFLAG = '1'
+            //        ORDER BY 
+            //            REPORTCODE
+            //        ",
+            //        new CDAParameter("USERID",context.Session["userId"])
+            //    );
+            //    dt.Merge(dtReport);
+            //}
+            //catch
+            //{
 
-            }
+            //}
             //================================================
 
             string rootId = dt.Rows[0]["id"].ToString();